Methods and apparatus for adaptive server reprovisioning under security assault

Abstract

Methods and apparatus for automated adaptive reprovisioning of servers under security assault. The method comprises detecting a security assault or a possible security assault on a first server, and reprovisioning by automatically creating a new server instance with a desired new server configuration to perform at least one of the tasks performed by said server.

1 . A method for automated adaptive reprovisioning of servers under security assault, the method comprising: 
 detecting a security assault or a possible security assault on a first server; and    reprovisioning by automatically creating a new server instance with a desired new server configuration to perform at least one of the tasks performed by said first server.    
     
     
         2 . The method of  claim 1 , wherein said detecting comprises determining if said first server is a candidate for reprovisioning, because of properties or behavior that suggest its security has been compromised or is likely to be compromised, or its functioning otherwise unacceptably impaired, by a security assault.  
     
     
         3 . The method of  claim 1 , wherein said reprovisioning comprises automatically bringing up said new server instance, or otherwise making available said new server instance to customers or other users of said first server.  
     
     
         4 . The method of  claim 1 , further comprising bringing down said first server prior to said reprovisioning.  
     
     
         5 . The method of  claim 1 , wherein said new server instance brought up in said reprovisioning differs from said first server in at least one parameter.  
     
     
         6 . The method of  claim 1 , wherein a difference between said new server instance and said first server is responsive to whether or not other security incidents have been detected in a network to which said servers are coupled.  
     
     
         7 . The method of  claim 1 , wherein a difference between said new server instance and said first server is responsive to a nature of any other security incidents that have been detected in said network to which said servers are coupled.  
     
     
         8 . The method of  claim 1 , wherein a difference between said new server instance and said first server is responsive to a probable compromise or a functional impairment observed in said detection.  
     
     
         9 . The method of  claim 1 , wherein a difference between said new server instance and said first server includes a version of server software used by said servers.  
     
     
         10 . The method of  claim 1 , wherein a difference between said new server instance and said first server includes a version of operating system software used by said servers.  
     
     
         11 . The method of  claim 1 , wherein a difference between said new server instance and said first server includes a version of network connectivity software used by said servers.  
     
     
         12 . The method of  claim 1 , wherein a difference between said new server instance and said first server includes strength of encryption used by said servers.  
     
     
         13 . The method of  claim 1 , wherein a difference between said new server instance and said first server includes a degree of function offered to users by said servers.  
     
     
         14 . The method of  claim 1 , wherein said new server instance brought up in said reprovisioning differs from said first server only if more than a fixed number of instances of probable server compromise have been observed.  
     
     
         15 . The method of  claim 1 , wherein a difference between said new server instance and said first server is responsive to a number of probable server compromises that have been observed.  
     
     
         16 . The method of  claim 1 , wherein said server comprises a computer providing services through a network.  
     
     
         17 . The method of  claim 1 , wherein said server comprises a program running on a network-coupled computer, providing services through a network.  
     
     
         18 . The method of  claim 1 , wherein said reprovisioning comprises selecting said desired new server configuration for said new server instance from a plurality of new server configurations.  
     
     
         19 . The method of  claim 18 , wherein said selecting said desired new server configuration for said new server instance comprises selecting a new server configuration from a table of new server configurations.  
     
     
         20 . The method of  claim 18 , wherein said selecting said desired new server configuration for said new server instance comprises randomly selecting a new server configuration from among all new server configurations in a table.  
     
     
         21 . The method of  claim 18 , wherein said selecting said desired new server configuration for said new server instance comprises randomly selecting a new server configuration from among all new server configurations in a table for which no probable compromise has been observed.  
     
     
         22 . The method of  claim 18 , wherein said selecting said desired new server configuration for said new server instance comprises indexing into a table according to a number of times a server providing a function of said first server has been subject to probable compromise.  
     
     
         23 . A computer-readable medium having stored thereon a plurality of instructions for automated adaptive reprovisioning of servers under security assault, said plurality of instructions including instructions which, when executed by a processor, cause said processor to perform: 
 detecting a security assault or a possible security assault on a first server; and    reprovisioning by automatically creating a new server instance with a desired new server configuration to perform at least one of the tasks performed by said first server.    
     
     
         24 . The computer-readable medium of  claim 23 , wherein said detecting comprises determining if said first server is a candidate for reprovisioning, because of properties or behavior that suggest its security has been compromised or is likely to be compromised, or its functioning otherwise unacceptably impaired, by a security assault.  
     
     
         25 . The computer-readable medium of  claim 23 , wherein said reprovisioning comprises automatically bringing up said new server instance, or otherwise making available said new server instance to customers or other users of said first server.  
     
     
         26 . The computer-readable medium of  claim 23 , further comprising bringing down said first server prior to said reprovisioning.  
     
     
         27 . The computer-readable medium of  claim 23 , wherein said new server instance brought up in said reprovisioning differs from said first server in at least one parameter.  
     
     
         28 . The computer-readable medium of  claim 23 , wherein a difference between said new server instance and said first server is responsive to whether or not other security incidents have been detected in a network to which said servers are coupled.  
     
     
         29 . The computer-readable medium of  claim 23 , wherein a difference between said new server instance and said first server is responsive to a nature of any other security incidents that have been detected in said network to which said servers are coupled.  
     
     
         30 . A system for automated adaptive reprovisioning of servers under security assault, the system comprising: 
 a first server;    a security monitor, coupled to said first server, for detecting if said first server is a candidate for automatic reprovisioning with a new server instance; and    a provisioner, coupled to said first server, for automatically reprovisioning said server with said new server instance if said server is such a candidate.